Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Charles Leclerc Ferrari Italian GP [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with uninstall/install URL hijack and bit.ly affiliate cloaking — monetization shell pattern.
• External JS host mlionltd.github.io is a user-controlled GitHub Pages domain — potential supply-chain risk.
• No CSP on MV3 extension with innerHTML sink in popup.js — DOM-XSS exposure.
• 16 months since last update — approaching stale threshold with active redirect monetization hooks.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall redirect to gameograf.com with UTM tracking — monetization shell pattern.
• affiliate_hits: bit.ly crx bit.ly in js_external_hosts flagged as affiliate/cloaking redirector by threat_intel.
• mlionltd.github.io external JS host crx GitHub Pages domain under third-party control; remote JS load surface not owned by developer.
• newtab override + search permission manifest chrome_url_overrides.newtab combined with search permission — standard NewTab monetization vector.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in popup.js with no CSP — DOM-XSS sink present.
• csp_present == false manifest No content_security_policy declared; MV3 default helps but no explicit restriction on inline sinks.
• months_since_update: 16 store 16 months without update; triggers stale risk band but below 18mo verified-publisher cap trigger.
• developer_name empty store No displayed developer name reduces accountability signal despite verified_publisher flag.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Charles Leclerc Ferrari Italian GP [adware] + malext.io malicious_extension_sentry; score 4.21 -> 6.71 (+2.5 cap 2.5).

Permissions Breakdown

• search medium Allows reading/overriding default search — core function for NewTab monetization.
• host_permissions: https://api.gameograf.com/* low Scoped to developer's own API domain; acceptable for content delivery.
• chrome_url_overrides.newtab medium Replaces new-tab page — primary monetization surface for this category.

Pillar Scores

Bookkeeping